The #DataInsecurity Digest | Issue 29

September 27, 2016/by

Issue 29 | September 28, 2016

#DataInsecurity Digest: Yahoo breach – who knew what, when? Hillary, Donald disagree on ‘the cyber’

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s Note: Half a billion. That’s how many accounts (so far) were compromised in the record-setting breach at Yahoo announced this past Friday. As Yahoo is the primary email account for many users, the breach is likely to affect many other services where users often reuse passwords. The advice to everyone who has a Yahoo account (and at that this point, that’s probably just about everyone) is to once again update your passwords to try to limit the fallout. What remains to be seen: could the Yahoo breach affect the company’s multi-billion acquisition by Verizon and will it become an issue on the campaign trail? So far, state-sponsored hacking has focused on explicitly political targets (e.g,. the DNC), but the Yahoo hack potentially affects far more consumers, potentially moving the data security debate back to being a front burner issue this election season.

In other breach news, Wall Street firm SS&C was scammed into transferring nearly $6 million into a Chinese hacker’s account. Meanwhile, the Government Accountability Office released a report that found that federal cyber incidents jumped 1,300 percent in the last 10 years. As if to illustrate this point, DCLeaks.com released Secret Service and Democratic advance documents involving the planned movements of Hillary Clinton, Michelle Obama, and Joe Biden. Needless to say, this breach raised several questions about how well our leaders are protected if hackers can so easily attain access to these secure documents.

And now, on to the clips!

—————–

At least 500 million Yahoo accounts compromised. Yahoo, one of the world’s busiest websites, has confirmed that it was the subject of the largest password breach in history, which compromised the “names, email addresses, telephone numbers, birth dates, encrypted passwords and, in some cases, security questions,” of 500 million of its account users. @nicoleperlroth reports that this massive data breach will have far-reaching implications for consumers. “Changing Yahoo passwords will be just the start for many users. They’ll also have to comb through other services to make sure passwords used on those sites aren’t too similar to what they were using on Yahoo. And if they weren’t doing so already, they’ll have to treat everything they receive online with an abundance of suspicion, in case hackers are trying to trick them out of even more information.” (Source: New York Times)

Questions remain about Yahoo’s culpability for breach. Important questions aboutthe record-setting breach at Yahoo were unanswered as the full scope and impact of the hack sank in over the weekend, writes @TechTimes_News’s Fritz Gleyo. For example, why did it take two years to discover the breach? Apparently the attackers were in the system as far back as 2014. Who did it? Yahoo blames a “state-sponsored actor” (read: Russia). How will it affect the Verizon-Yahoo acquisition? The breach could cause Verizon to modify the deal. (Source: Tech Times)

Quick hit: Is a SEC investigation coming? @madhumita29 of @FT says it’s quite possible. “If I were at the SEC, I’d be looking for the perfect case, the perfect storm. This may be it.” (Source: Financial Times)

Breach could make Yahoo “worthless.” With class-action suits already being filed by affected users, the impact on Yahoo’s worth to Verizon given the legal risk could be significant, writes @MikeSnide and @eweise. “Bulger estimates that Yahoo will likely have to pay at least $10 per user in reparations. That could amount to $5 billion — more than Verizon’s $4.8 billion paying price — making Yahoo ‘worthless,’ he said.” (Source: USA Today)

Hillary: Cyber “one of the biggest challenges facing the next president.” Cybersecurity issues got a nod at Monday’s debate. Clinton on the recent Russian hacking: “There’s no doubt now that Russia has used cyber attacks against all kinds of organizations in our country and I’m deeply concerned about this.” For his part, Donald Trump was somewhat circumspect in describing the Russian threat, saying “”[s]he’s saying Russia, Russia, Russia. Maybe it was. It could be Russia but it could be China, it could be lots of people. It could be somebody that sits on their bed that weighs 400 pounds.” (Source: CNET)

GAO: Federal cyber incidents jump 1,300 percent in 10 years. The U.S. Government Accountability Office (GAO) presented a report last week to the President’s Commission on Enhancing National Cybersecurity detailing the concerning trend of cybersecurity breaches at federal agencies. @JoeDavidsonWP reports that the GAO study found, “The number of cyber incidents reported by federal agencies jumped more than 1,300 percent, from 5,503 to 77,183, over the 10 years through fiscal 2015.” (Source: Washington Post)

Minute-by-minute schedules of Clinton, Biden, and Michelle Obama leaked. DCLeaks.com, the site that previously released Colin Powell’s personal emails, posted hundreds of emails from a Democratic staffer that listed the “phone numbers of numerous Secret Service agents, spreadsheets with the names and Social Security numbers of campaign donors, and PowerPoint presentations showing step-by-step directions for where officials like Vice President Joseph R. Biden Jr. should walk when they arrived at events.” @shearm and @AllMattNYT commented that fortunately, the emails contained movement information for previous, not future, events. (Source: New York Times)

Mellul’s account hack may stem from 2013 Adobe breach. Account information for Ian Mellul, the contractor whose hacked email account was used to release the sensitive information about Michelle Obama, Hillary Clinton, and others, was likely first exposed in the 2013 breach of Adobe users’ data, writes @thepacketrat. “Government sources have described DCleaks.com as being connected to Russian intelligence organizations. But just about anyone could have gotten into Ian Mellul’s e-mail if he was using the same password for his Gmail account that was exposed in a 2013 breach of Adobe user data…” (Source: Ars Technica)

Future of ransomware: More expensive and targeted. Followers of ransomware news know that the attacks are not only growing in frequency, but also in sophistication. @briankrebs speculates this trend will only continue: “What we can expect is not only more targeted and destructive attacks, but also ransom demands that vary based on the attacker’s estimation of the value of the data being held hostage and/or the ability of the victim to pay some approximation of what it might be worth.“ Lawrence Abrams, owner of the tech-help site @BleepinComputer agrees that ransomware attackers will increasingly seek out affluent holders of valuable information: “these guys are going to start more aggressively targeting really data intensive organizations like medical practices and law and architectural firms.” (Source: Krebs on Security)

Election systems will not be classified as critical infrastructure … for now. The Department of Homeland Security’s (DHS) Assistant Secretary for Cybersecurity, Andy Ozment, commented last Tuesday that DHS will not reclassify election systems as critical infrastructure, a move that would give DHS increased resources and additional authorities before the November election. “This is not something we’re looking to in the near future. This is a conversation we’re having in the long term with state and local government …To some degree this question of ‘is it critical infrastructure or not’ is a distraction from the important thing, which is that everybody needs to help each other out.” (Source: FedScoop)

Some in Congress disagree with DHS decision. Rep. Hank Johnson (D-GA), a member whose district is reliant on electronic voting, introduced two bills named the “Election Infrastructure and Security Promotion Act of 2016” and the “Election Integrity Act.” These bills would “require the Department of Homeland Security, or DHS, to designate voting systems as critical infrastructure… compel states to comply with relevant federal rules while incorporating additional security standards and testing measures,” and prohibit “election systems responsible for vote casting or tabulating” from being connected to the Internet. (Source: FedScoop)

Krebs on Security attacked. Brian Krebs, one of the most prominent data insecurity reporters, faced one of the largest distributed denial-of-service attacks on record last week. @briankrebs reports, “On Tuesday evening, KrebsOnSecurity.com was the target of an extremely large and unusual DoS attack designed to knock the site offline. The attack did not succeed thanks to the hard work of the engineers at Akamai, the company that protects my site from such digital sieges. But according to Akamai, it was nearly double the size of the largest attack they’d seen previously, and was among the biggest assaults the Internet has ever witnessed.” (Source: Krebs on Security)

Hackers steal $6 million from Wall Street tech firm in phishing attack. SS&C Technologies, a $6 billion market capitalization company, is being sued for falling for a series of email scams that led to their employees transferring nearly $6 million into the accounts of the Chinese hackers. Lawyers filing the suit stated that the firm did not “exercise even a modicum of care and responsibility in connection with known and obvious cybersecurity threats.” (Source: CNBC)

Upcoming event

January 12, 2017 – PrivacyCon – Washington, DC
The FTC will host its second PrivacyCon conference “to continue and expand collaboration among leading whitehat researchers, academics, industry representatives, consumer advocates, and the government to address the privacy and security implications of emerging technologies.”

National Consumers League
Published September 28, 2016

Health Advisory Council Newsletter | 2016 Q3

September 26, 2016/by

Welcome to the Q3 issue of the Health Advisory Council Newsletter. This quarter, NCL and Council members have been active on many fronts. Please read on for NCL policy updates, a new Q&A with the Consumer Healthcare Products Association Educational Foundation, member updates, and more.

Save the Date! 11/16 Ensuring Consumer Access to Healthcare Conference

In response to Health Advisory Council member interest in a policy forum on access, NCL is sponsoring a Nov. 16, 2016 conference on Ensuring Consumer Access to Healthcare. The conference will bring together patient and consumer advocates, healthcare professional organizations, pharmaceutical and healthcare industry representatives, minority groups, insurers, researchers, and government officials for a thought-provoking examination of the current state of healthcare in America, and ways we can improve and increase access to care for all.

Discussion Panels include:

Strategies to Address the High Cost of Healthcare: Is Access for All Achievable?
The Move towards Value-Based Healthcare to Improve Patient Access
Improving Access to Care for Underserved and Minority Populations

NCL Health Policy at Work

NCL-AHIP Partnership: MyHealthPlanGuide — In August, NCL announced its new partnership with America’s Health Insurance Plans (AHIP) to create accessible, educational content to help consumers develop the literacy skills needed to better navigate the complex and changing health care system. Central to the partnership is a new interactive website for consumers, named MyHealthPlanGuide, which is slated for launch in early October. We look forward to sharing this resource with you!

Prescription Drug User Fee Act Reauthorization — In August, NCL testified at the FDA Public Meeting on the reauthorization of the Prescription Drug User Fee Act (PDUFA VI). NCL expressed its support for the PDUFA program and many of the features of PDUFA VI, while stressing the need for the FDA to remain independent and not compromise its high standards for safety, efficacy, and quality of prescription drugs.

Click here for more NCL health policy updates.

Member spotlight

Get to know Health Advisory Council member Consumer Healthcare Products Association Educational Foundation with a new Q&A.

Updates on member programs

Allergan
Allergan’s Bold Social Contract with Patients. In September, Allergan CEO and President Brent Saunders addresses commitment to innovation, access, and responsible pricing ideals and announces a bold Social Contract with Patients. The social contract is a commitment to live by 4 principles:

Principle 1: Invest & Innovate
Principle 2: Access & Pricing
Principle 3: Quality & Safety
Principle 4: Education

Please learn more about these principles here.

Eli Lilly and Company
Today, more than 5 million Americans are living with Alzheimer’s disease. One in nine over the age of 65 has the disease, with the prevalence increasing to almost a third among those age 85 and older. Eli Lilly’s Alzheimer’s Readiness Project is committed to inspiring action by fostering a deeper understanding of Alzheimer’s, its evolving science, and the public health crisis it poses. Through outreach, events and partnerships, the Project strives to be an important partner and voice in the global Alzheimer’s conversation, elevating awareness of the need for and value of advancements in the fight against Alzheimer’s disease. To learn more, visit alzreadinessproject.com.

Food and Drug Administration/Center for Drug Evaluation and Research
Drug Safety Labeling Changes (SLC) Database
Drug safety labeling changes (SLC) data on the Web will now be available much faster for health care providers, health information technology vendors, and the public to view, search, and download.

Prior to September 2016, FDA’s MedWatch program posted safety labeling changes on a monthly basis. Now, the SLCs will be housed in a CDER database and published as close to the day of the labeling supplement approval as possible. Prompt access to these vitally important safety data will ultimately benefit patients as this information will be communicated to their health care providers in a much more timely manner. The new CDER database will include SLC data from January 2016 forward. Data prior to January will continue to be available on the MedWatch Web site. Learn more here or access the database here.

Orange Book Web 2.0
FDA launched an enhanced Web site for the Approved Drug Products with Therapeutic Equivalence Evaluations list – most commonly known as the “Orange Book.” The Orange Book identifies drug products approved on the basis of safety and effectiveness by FDA. Orange Book users include pharmacists, prescribers, industry, Agency employees, and third-party payers.

The redesigned Orange Book has an improved look, feel, and functionality. Commonly used features, such as the search and browse options, can now be found on the home page. New features will help users navigate the Orange Book and customize their research. The new design also displays groups of accordion-like panels, which open to reveal new and enhanced features. It gives users a link to background information, Orange Book publications, and contact information.

The Orange Book first appeared as a print publication in October 1980. Since 1984, it has included information about patents and exclusivity for listed products. In 1997, FDA made the Orange Book database available for searching on the Web. Today “Orange Book” is one of the most searched-for terms on FDA.gov. This user-friendly technology is also available as a mobile application, making it easier to access important drug information.

McNeil Consumer Healthcare
McNeil Consumer Healthcare is thrilled to announce the expansion and complete redesign of GetReliefResponsibly.com. Grounded in consumer insights and data, the new website has updated content and resources, a new look and feel, and an improved user experience geared to our key audiences. The objective of this site has broadened beyond providing education about the safe use of acetaminophen to providing education about the appropriate choice and use of OTC analgesics and the safe storage and disposal of all OTCs.

In conjunction with the consumer site, McNeil also launched the Get Relief Responsibly® Professional Resource Center: GetReliefResponsiblyProfessional.com. Targeted to healthcare professionals (HCPs), the site aims to empower HCPs to make appropriate OTC analgesic recommendations and to encourage safe use dialogue with their patients. With the re-launch of the new, unbranded GetReliefResponsibly.com, McNeil is proud to offer direct pathways to many of its partner organization websites and resources. If you have any questions or are interested to learn more, please reach out to Leily Saadat-Lajevardi at lsaadat@its.jnj.com.

Medication Adherence Alliance
The Medication Adherence Alliance is an organization comprised of representatives from consumer advocacy groups, community health providers, non-profit groups, the academic community, decision-making government officials and industry representatives. Launched in early 2016, The Medication Adherence Alliance’s new website, http://managingyourmeds.org, serves as a comprehensive repository of up-to-date adherence resources. From patient tools to new research findings to updates on related policies, the website provides a wealth of information for the health care community on medication adherence. Features include:

Patient and Provider Toolkits: Including a variety of products patients and providers can use to encourage medication adherence;
Adherence Facts: Key information for all members of the health care community;
Promising Practices: A compilation of current practices, as well as practices under development, that aim to help patients remain adherent; and
Research Compendium: Consisting of original research, reviews and meta-analyses and commentaries.

Upcoming Conference: Suboptimal Medication Use and Population Health – Intersection of Research, Implementation, and Policy
The Suboptimal Medication Use and Population Health – Intersection of Research, Implementation, and Policy Conference will be held in Washington DC, December 5-6, 2016. The conference will assemble a variety of stakeholders representing diverse backgrounds (payers, patients, researchers, policymakers and government officials) to identify and disseminate practical and effective strategies to improve population health through better medication use. Conference details and registration information are coming soon.

National Association of Nurse Practitioners in Women’s Health
Call for public comment: Women’s Preventive Services Initiative draft recommendations

The Women’s Preventive Services Initiative (WPSI) Advisory Panel* and Multidisciplinary Steering Committee have released draft recommendations for women’s preventive health care services, including the HRSA-sponsored Women’s Preventive Services Guidelines. The draft recommendations are available for public comment from September 1-30, 2016. Please consider reviewing and contributing your feedback on these draft recommendations. Click here to enter your comments.

*The WPSI is overseen by an Advisory Panel comprised of representatives from The American College of Obstetricians and Gynecologists (ACOG) and three other major professional organizations representing the majority of women’s health care providers, including the American Academy of Family Physicians (AAFP), American College of Physicians (ACP), and National Association of Nurse Practitioners in Women’s Health (NPWH). The Advisory Panel guides the work of the WPSI and ensures that the initiative delivers a consistent message.

National Council on Patient Information and Education (NCPIE)
Talk About Your Medicines Month (October 2016) – This October marks the 31^stannual observance of “Talk About Your Medicines Month” by the National Council on Patient Information and Education (NCPIE) to call attention to the impact that high-quality patient – healthcare provider communication can play in promoting better medicine use and better health outcomes. This year’s theme: Let‛s Talk About Polypharmacy: America’s Other Drug Problem, casts a spotlight on a significant and growing medication safe use issue – POLYPHARMACY, the use of 5 or more medications by the same person at the same time – putting patients at increased risk for drug interactions and side effects. Coming soon on talkaboutrx.org will be tips and resources for patients and providers to help manage polypharmacy including a “Are you at risk for harm by polypharmacy” checklist. Please contact Deborah Davidson at ddavidson@ncpie.info if you are interested in receiving the 2016 TAYM Month communications toolkit.

USP
The U.S. Pharmacopeial Convention (USP) launched the next generation of its Food Fraud Database (FFD 2.0) to help food manufacturers and retailers make informed decisions about ingredients in their portfolio that may have a greater potential of being adulterated. The goal is to provide brand protection, increase consumer trust and support new food safety regulations recently finalized by the FDA.

Food fraud, also referred to as economically-motivated adulteration (EMA), is a global economic and public health problem, costing industry an estimated 10 to 15 billion dollars annually and affecting as much as 10 percent of the global food supply.

USP’s FFD 2.0 provides hazards reports on specific adulterants, making it easier for manufacturers and retailers to quickly identify ingredients with a known history of adulteration with potentially hazardous substances. For more information on the FFD 2.0 and other food fraud prevention tools, including standards, training and advising services, visit www.foodfraud.org.

We want to hear from you!

Online members-only discussion board – We encourage you to take advantage of the online members-only communications portal, where members may share news, suggestions, and ideas directly with each other. Log on here. If you haven’t already, you will be instructed to create an account in order to view discussion items. The members-only forum is only visible to people who have been given access privileges.

Thank you for your continued interest in the Health Advisory Council!
Please stay in touch! Feel free to contact Karin Bolte (karinb@nclnet.org) or Amy Sonderman (amys@nclnet.org).

_______________

National Consumers League
Published September 28, 2016

Health Advisory Council Newsletter | 2016 Q3 | Member Q and A

September 26, 2016/by

2016 | Q3 Newsletter | Q & A with Health Advisory Council Member

Colleen Creighton

Director, Consumer Healthcare Products Association (CHPA) Educational Foundation

Q. Please discuss your work at the CHPA Educational Foundation and how it relates to the overarching mission of the Foundation.

A. It’s an exciting time for the CHPA Educational Foundation. With a new vision, mission, and board of directors in place, in 2015 we launched a full new consumer brand, KnowYourOTCs.org. With our new structure in place, the foundation has now established itself as the trusted source of information on the responsible use, storage, and disposal of consumer healthcare products including over-the-counter medicines and dietary supplements. As director of the foundation it’s been wonderful seeing the pieces come together and to see the tremendous growth that has taken place for each of our educational campaigns under the new framework.

Q. How long have you been at the CHPA Educational Foundation, and what do you love most about your job?

A. I have been at the foundation for two years. What I love most is not only are we making a difference in the lives of consumers across the country, but I also get to work with and learn from so many of our incredible organizational partners each day. We also have such a unique blend of board of directors and foundation supporters that are personally and organizationally dedicated to the cause of improving consumer health. CHPA truly feels like a team coming together with a common goal of “Happier Healthier Lives Through Responsible Self-Care.”

Q. What are the biggest challenges and opportunities facing the CHPA Educational Foundation today?

A. With the speed at which the foundation is growing, the current challenge is ensuring we can effectively meet consumer demand. In 2015, we distributed more than 707,000 of our educational materials, engaged more than 800,000 healthcare providers and consumers, collaborated with more than 50 organizational partners, and generated more than 155 million media impressions. So far in 2016 we are on track to surpass last year. While a challenge, it is also an opportunity to engage new partners and supporters to help us reach even more consumers to get them the information they not only want, but need.

Q. What CHPA Educational Foundation initiatives would you like to share with the Council?

A. All the work the foundation is involved in falls under the structural umbrella of use, storage, and disposal of over–the-counter medicines and dietary supplements. Within use, we have our Know your Dose Campaign which educates consumers on acetaminophen safety and Treat With Care which educates parents on the responsible use of pediatric cough and cold products. For storage, we work with the CDC on our Up and Away Campaign which educates consumers on the importance of storing medicines up and away and out of reach of children. We also work to educate consumers on how to dispose of their expired and unwanted over-the-counter medicines. We are always looking to further the reach and impact of our campaigns so if any council members would like further information on any of these campaigns or would like to get involved in any of our outreach and activities, please contact me at ccreighton@chpa.org.

Q. What does the CHPA Educational Foundation value about membership in NCL’s Health Advisory Council?

A. For our foundation, the most valuable aspect of the Health Advisory Council is its membership. From the very first meeting, all the council members have been extremely engaged in sharing information and opening doors for collaboration. Thanks to this council we have been able to increase distribution of our medicine disposal posters, add partners to our campaigns, and expand the reach of our educational messaging. We are looking forward to remaining involved in the council for many more years.

NCL health policy updates | Health Advisory Council Newsletter | 2016 Q3

September 26, 2016/by NCL staff

NCL-AHIP Partnership: MyHealthPlanGuide — In August, NCL announced its new partnership with America’s Health Insurance Plans (AHIP) to create, accessible educational content to help consumers develop the literacy skills needed to better navigate the complex and changing health care system. Central to the partnership is a new interactive website for consumers, named MyHealthPlanGuide, which is slated for launch in early October. We look forward to sharing this resource with you!

Dietary Supplements Quality Collaborative — NCL recently joined the Dietary Supplements Quality (DSQ) Collaborative, which is supported by USP and consists of 18 organizations that are committed to advancing the quality and safety of products marketed as dietary supplements in the United States. One of the main goals of the DSQ Collaborative is to develop strategies to protect consumers from bad actors and dangerous products.

Script Your Future Campaign — Karin Bolte, NCL’s Health Policy Director, was pleased to present the 2016 Medication Adherence Team Challenge awards at the American Association of Colleges of Pharmacy’s (AACP) Annual Meeting in July. This year’s award winners were the University of Charleston School of Pharmacy (National Award), University of Pittsburgh School of Pharmacy (National Award), Northeast Ohio Medical University (Health Disparities), University of North Carolina at Chapel Hill (Media), and the University of Maryland School of Pharmacy (Creative Interprofessional Team Event). NCL is busy preparing for the 2017 Team Challenge. In addition, NCL has been invited to give an overview of lessons learned from the Script Your Future campaign at the Dec. 5– 6 Suboptimal Medication Use and Population Health-Intersection of Research, Implementation, and Policy conference in Washington, DC.

We Won’t Wait Campaign — NCL has joined WomenAgainstAlzheimer’s We Won’t Wait campaign, the first-ever widespread effort to define Alzheimer’s as the 21st Century’s primary economic justice issue and health crisis for women. NCL was a co-host with WomenAgainstAlzheimer’s, Eli Lilly’s Alzheimer’s Readiness Project, and other campaign partners of a Women Leading the Way luncheon at the Democratic National Convention in July. NCL will also be participating in the National Alzheimer’s Summit on September 28.

Thought Leaders series: Interview with AG Lisa Madigan

September 13, 2016/by

#DataInsecurity Digest Interview with Attorney General Lisa Madigan

NCL: Illinois is considered by many to have some of the strongest data breach notification and data security laws in the country. How would you describe the state of data security in Illinois? How have Illinois’ actions on data security affected the debate about data security nationally?

AG Madigan: Data security is one of the biggest challenges we face as a nation and Illinois is no exception. It’s an ongoing struggle for all Americans and the companies, non-profits and government agencies that hold our personal information. For more than a decade, my office has helped consumers clean up from identity theft damage and has investigated dozens of major breaches. In fact, we’ve helped more than 41,000 consumers remove more than $28 million worth of fraudulent charges.

At this point, Americans realize it’s not a matter of if, but when, they will be a victim of some form of identity theft. In this environment, Americans need and expect more transparency of data breaches. Not less.

NCL: Many data breach notification and data security laws were introduced in Washington, DC during the 114th Congress, but none of them was enacted into law. In the next Congress, what steps should policymakers at the federal level take to reduce incidences of data breaches and help consumers avoid the fallout?

AG Madigan: I’ve testified in support of federal data security legislation in both the U.S. House and Senate and to share the concerns of Illinois consumers. They have told me they are concerned by the increasing number of breaches. They demand notification when their information is stolen. They want to know what they can do to protect themselves from identity theft. And they want to know whether companies are doing enough to prevent breaches and protect their information.

So a weak, national law that restricts what most state laws have long provided will not meet consumers’ increasing expectation that they be told when their information has been stolen. Instead, Congress should seek to pass legislation that ensures notification of breaches of information that can harm Americans. Therefore, the definition of “protected personal information” should be broad and include the growing amount of sensitive information that companies are collecting from consumers. I also think it’s vital that federal law not preempt state data breach laws.

NCL: Illinois has one of the nation’s strongest privacy laws in the country regarding biometric data — the Biometric Information Privacy Act. That law has been under scrutiny by the legislature and the courts this year. From your point of view, what is the benefit of this law to consumers, and what do you think the future holds for biometric privacy laws in Illinois and beyond?

AG Madigan: The Illinois Biometric Information Privacy Act (BIPA) offers enormous protections to consumers over biometric information and significantly reduces the risk of identity theft. At its core, BIPA requires companies to provide notice to and consent by consumers to use their biometric data, limits the scope of how the data can be used, requires companies to use reasonable security measures to protect the data and requires permanent destruction of biometric data within a set period of time. Importantly, BIPA prohibits the sale, lease or trade of biometric data.

NCL: From your point of view, what role should states play in protecting consumers from data breaches and also assisting them in the aftermath of a breach?

AG Madigan: The states have been inundated with consumers who need help understanding and recovering from breaches and identity theft damage. As a result, I created an Identity Theft Unit and Hotline back in 2006.The hotline, the first of its kind in the country, operates with real people who help consumers restore their credit when their information was obtained and used without their authorization.

In addition to direct consumer assistance, my office has conducted dozens of data breach investigations to confirm companies complied with state law by notifying customers of breaches within a reasonable time and to ensure entities suffering breaches took reasonable steps to protect consumers’ sensitive data from disclosure.

My office’s investigations have revealed that organizations too often fail to take basic data security precautions. We have found numerous instances where companies:

Allowed sensitive personal data to be maintained unencrypted;
Failed to install security patches for known software vulnerabilities;
Collected sensitive data that was not needed;
Retained data longer than necessary; and
Failed to protect against compromised credentials.

The states’ role in consumer education is critical. My office has held about 30 roundtables on data breaches throughout Illinois, with more than 1,000 consumers, including local government officials, chambers of commerce, law enforcement, small business owners, banks, religious leaders, senior citizens, hospitals and heads of social service agencies.

NCL: In 2005, you successfully shepherded the Personal Information Protection Act (PIPA), which included a data breach notification requirement, into law. This year, you advocated for a new bill, House Bill 1260, which significantly strengthens PIPA. How will the new bill affect Illinois consumers?

AG Madigan: My office spearheaded significant updates to the Illinois Personal Information Protection Act (PIPA) that provide some of the most significant enhancements today in protecting consumers’ data security. With the passage and enactment of House Bill 1260, Illinois maintains its status as having one of the strongest breach notification and data security laws in the country.

Key changes to PIPA include:

Expanding the definition of Personal Information to include the following new triggering elements, when combined with an individual’s first name or first initial and last name:
- Medical information;
- Health insurance information;
- Unique biometric data generated from measurements of technical analysis of human body characteristics (e.g., fingerprint, retina/iris scan, etc.);
- Username or email address plus a password or security question and answer that would permit access to an online account;
- Specifying that a breach of encrypted Personal Information requires breach notification IF the encryption key is access without authorization;
- Requiring data collectors to implement and maintain reasonable data security measures to protect records from unauthorized access, acquisition, destruction, use, modification, or disclosure;
- Notifying my office of State Agency breaches involving more than 250 residents; and
- Implementing a modification to the Substitute Breach Notice by non-state agencies to allow for notification to local media vs. statewide media if impacted consumers are within a limited geographic area and are likely to be notified.

NCL: In recent months, we’ve also learned of possibly state-sponsored hacks of a number of states’ voting systems. The state of Illinois won one of those targets, suffering a cyber attack that allowed hackers to access up to 200,000 voter registration files and forcing Illinois’ voter registration database to shut down for two weeks. Recognizing that it’s still early in the process, what lessons have you learned from this attack and what advice would you give to other state leaders on this issue?

AG Madigan: There is currently an ongoing federal investigation into that data breach. I think this breach is yet another example of why we need to ensure that we are taking all the steps we can to protect consumers’ personal information.

NCL: Your office has taken a leading role in promoting good cyber citizenship by promoting “Secure It Days” where students identify and fix vulnerabilities in their online presence by taking steps such as updating their antivirus protections or strengthening their passwords. What other steps is your office taking to help educate consumers and businesses on the importance of good cyber hygiene?

AG Madigan: My office holds “Secure It Days” to provide students advice and real-life scenarios on the safest ways to use the Internet, apps and online games.

We also train students and their parents through the work of my office’s Internet Safety Specialists. Through a grant from the U.S. Department of Justice, my office runs the Internet Crimes Against Children (ICAC) Task Force. So far, we have provided Internet safety trainings and education to more than 530,000 parents, teachers and students and more than 20,000 law enforcement professionals. During these safety trainings and discussions students, parents, and teachers alike are able to work together to learn best practices in staying safe online.

###

Published by National Consumers League’s #DataInsecurity Digest
September 14, 2016

The #DataInsecurity Digest | Issue 28

September 13, 2016/by NCL staff

Issue 28 | September 14, 2016

#DataInsecurity Digest: Russians hack WADA, ransomware on tap at the FTC and our interview with AG Madigan

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s Note: We are excited for our second installment of our #DataInsecurity Thought Leaders series featuring Illinois Attorney General and 2016 Trumpeter Award Recipient Lisa Madigan! Excerpts from our chat are below, and the full interview is available online.

The same Russian outfit that hacked the DNC is making news again, this time for a hack of the World Anti-Doping Agency, which has been at the center of a report alleging massive cheating by Russian athletes. At an FTC forum on ransomware, Chairwoman Ramirez recently stated that ransomware is the “new business model” for scammers. The FTC’s focus is unsurprising, given new estimates that it’s costing businesses $75 billion per year. A new House Oversight Committee’s report on the OPM breach, which ranks among the most serious in recent memory, is blistering, pointing the finger at a failure of leadership at the agency. The Department of Education could be in Oversight Chairman Rep. Jason Chaffetz’s sights next, as he again warned that a breach there could be even more damaging than the one at OPM. It was another big week for breaches with Kimpton Hotels and adult website Brazzers being hit, potentially exposing 800,000+ users. Not to be forgotten, Russia again made cybernews this week as federal investigators announced an investigation into Russia’s possible intent to use cyber attacks at the DNC to undermine American confidence in the election process.

—————–

Thought Leaders interview with Attorney General Lisa Madigan

Illinois Attorney General Lisa Madigan sat down to answer questions for us about the role her office is playing in keeping Illinois consumers safer from data breaches and identity fraud. Excerpts from our interview are below. You can read the full interview at our site.

AG Madigan: Data security is one of the biggest challenges we face as a nation and Illinois is no exception. It’s an ongoing struggle for all Americans and the companies, non-profits, and government agencies that hold our personal information. … At this point, Americans realize it’s not a matter of if, but when, they will be a victim of some form of identity theft. In this environment, Americans need and expect more transparency of data breaches. Not less.

NCL: Many data breach notification and data security laws were introduced in Washington, DC during the 114th Congress, but none of them were enacted into law. In the next Congress, what steps should policymakers at the federal level take to reduce incidences of data breaches and help consumers avoid the fallout?

Read full interview here.

This edition’s #DataInsecurity Clips

Gold medal for hacking: Russians breach World Anti-Doping Agency. The same outfit thought to be responsible for breaches at the Democratic National Committee is responsible for hacking into athletes’ medical records in advance of the Rio Olympics. Writes @publicbill: “Some of the data listed athletes’ therapeutic use exemptions, which allow banned substances to be taken if they’re deemed to be necessary for an athlete to cope with an illness or medical condition. … The breach is believed to be a case of ‘spear phishing of email accounts[.]’” (Source: NPR)

Ramirez: Ransomware the most profitable malware in history. The FTC kicked off its Fall Technology Series last week with a thorough discussion on ransomware. @Slabodkin reports that Chairwoman Ramirez set the tone by declaring that “ransomware is ‘among the most troubling cyber threats’ confronting the United States that is ‘becoming increasingly more pernicious’ and is ‘escalating at an alarming rate.’ Citing statistics…that the U.S. averages 4,000 incidents per day.” (Source: Information Magnet)

Ransomware costs businesses an estimated $75 billion a year. Longtime readers of The #DataInsecurity Digest will recall the FBI’s recent announcement that ransomware attacks cost victims a total of $209 million in the first three months of 2016. @datto, a cybersecurity company, now claims a higher estimate of $75 billion a year, factoring in lost productivity, the ransomware payment itself, and the finding that “less than 1 in 4 ransomware incidents are reported to the authorities.” (Source: The Atlantic)

OPM breach a “failure of culture and leadership, not technology.” The House Oversight Committee released its long awaited 241-page report on the unprecedented 2014 breach at the Office of Personnel Management (OPM) that compromised the background records of millions of Americans. In addition to finding that the government has never been more vulnerable to cyber attacks, it found: “the long-standing failure of OPM’s leadership to implement basic cyber hygiene…despite years of warnings from the inspector general, represents a failure of culture and leadership, not technology.” (Source: Fed Scoop, Full report)

Chaffetz: Breach at DOE could be worse than OPM. Following up on his committee’s report on OPM, Rep. Chaffetz bestowed the title of “the biggest vulnerability that I see out there right now” on the Department of Education (DOE). @Nextgov reports that Chavez lamented woeful security at the agency, which holds 130 million Social Security numbers in its databases: “despite housing tens of millions of people’s sensitive information and 180-plus databases, the agency doesn’t ‘even have the most basic of tools’ to protect them against breaches.” (Source: Nextgov)

Breach du jour: Kimpton Hotels. Kimpton Hotels, a subsidiary of Intercontinental Hotels Group, is the latest hotel chain to be breached, with a POS system malware attack on 62 properties and restaurants. @stevenmusil reports, “Cards used at certain restaurants and hotel front desks between February 16 and July 7 may be affected. The chain has published a list of properties where customers’ cards may be affected, along with specific at-risk time frames, and said it will be contacting customers who may have had data exposed.” (Source: CNET)

Breach du Jour part II: Nearly 800,000 Brazzers accounts compromised. The adult website Brazzers suffered a massive breach that revealed the email addresses, usernames, and plaintext passwords of nearly 800,000 of its users. Troy Hunt, creator of Have I been Pwned, which helped validate the authenticity of the breach noted, “We also know that forum breaches frequently include not just user credentials, but private messages as well, and those can be particularly revealing.” (Source: Motherboard)

Russian hacking plan to undermine confidence in U.S. electoral process under investigation. As leaders in Washington plan their response to Russia’s alleged hack of the DNC and the Arizona and Illinois voter registration databases, @danapriest reports that the Director of National Intelligence James Clapper Jr. has been chosen to lead the investigation aimed at discerning “the [attack’s] scope and intent.” The investigation follows Putin’s recent comment, “It doesn’t really matter who hacked this data from Mrs. Clinton’s campaign headquarters. …The important thing is the content was given to the public.” (Source: Washington Post)

Upcoming event

National Consumers League
Published September 14, 2016

Thank you for registering for our event

September 8, 2016/by

You have successfully registered! Stay tuned for more information from us. Check the email account you used to register for a confirmation email.

Thank you for being a member of our community.

nclnet.org home

The #DataInsecurity Digest | Issue 27

August 31, 2016/by NCL staff

Issue 27 | August 31, 2016

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s Note: Wow, we take a few weeks off for R&R and data security news lights up. Fortunately, we’re back from our summer break, so it’s time to catch you up on what you may have missed.

The epic hacking—if true—of the National Security Agency (NSA) has reportedly exposed many of the their trade secrets. In addition, Wikileaks’ reputation took a hit when it distributed apparently hacked (or leaked) data that contained sensitive information of private citizens, including their Social Security numbers and sexual orientations. In somewhat more commonplace data security news, Eddie Bauer joined the ranks of retailers suffering from point-of-sale (POS) breaches when they discovered that all 350 of their North American stores were infected with malware. This will no doubt cause a dent in their sales; KPMG found that 19 percent of consumers will stop shopping at a retailer altogether in the wake of a data breach. However, news of a potential hack at Oracle—a major vendor of POS software systems—could point the finger at someone besides the retailers for this latest spate of attacks.

And now, on to the clips!

—————–

Breach du jour: Eddie Bauer stores POS systems breached. News broke that malware infected point-of-sale systems at more that 350 Eddie Bauer stores in North America during the first six months of 2016. The malware is said to have been scooping up the credit and debit card numbers of shoppers at the chain’s retail locations. Security researcher @briankrebs, who originally alerted the store of a potential breach 6 weeks before it was announced, used the news as a teachable moment for the industry calling on all breached entities to “offer the cyber defenders of the world just a few details about the attack tools and online staging grounds the intruders used. That way, other companies could use the information to find out if they are similarly victimized and to stop the bleeding of customer card data as quickly as possible.” (Source: KrebsOnSecurity.com)

Is a breach at Oracle the source of retail, hotel breaches? Regular readers of the #DataInsecurity Digest will note that we haven’t been shy in noting the spate of breaches at restaurant, retail, and hotel chains recently. If @briankrebs is to be believed, a breach at cloud giant Oracle—specifically its MICROS point-of-sale provision system—could be the culprit. Writes Krebs, “MICROS is among the top three point-of-sale vendors globally. Oracle’s MICROS division sells point-of-sale systems used at more than 330,000 cash registers worldwide … the company said MICROS’s systems were deployed at some 200,000+ food and beverage outlets, 100,000+ retail sites, and more than 30,000 hotels. … Oracle’s own statement seems to suggest the company is concerned that compromised credentials for customer accounts at the MICROS support portal could be used to remotely administer — and, more importantly, to upload card-stealing malware to — some customer point-of-sale systems.” (Source: KrebsOnSecurity.com)

More evidence that data breaches lead to lost customers. KPMG’s 2016 Consumer Loss Barometer, has found that consumers will readily cease doing business in the wake of a data breach. The barometer found that among the 448 consumers that were surveyed, “19 percent said they would stop shopping at a retailer that had been a victim of a cybersecurity hack, even if the company took the necessary steps to remedy the issue. In addition to those who would abandon the retailer entirely, 33 percent of the consumers indicated that fears of further exposure of their personal information would prevent them from shopping at a breached retailer for at least three months.” (Source: KPMG and PRNewswire)

Trump campaign hacked. Reuters reports, “At least one Trump staff member’s email account was infected with malware in 2015 and sent malicious emails to colleagues, according to one insider for the Republican candidate’s campaign and an outside security expert.” Two sources told Reuters that “The tools and techniques used to hack Republican targets resemble those employed in attacks on Democratic Party organizations, including the DNC and Clinton’s campaign organization… That has led U.S. officials to reach a preliminary assessment that Russia’s military and civilian intelligence agencies or their proxies have targeted both political parties.” (Source: Reuters)

ICYMI: The NSA was hacked last week. The hacking group, Shadow Brokers, is auctioning off the NSA’s cyber weapons, reportedly from the NSA’s elite hacking outfit, the “Equation Group.” Such a breach raises serious concerns due to the amount of personal data the NSA collects and what could happen if these hacking tools ended up in the wrong hands. In the wake of the breach, investigators have been scrambling to see what went wrong. As @PaulSzoldra reports, “There are now two prevailing theories as to how the Shadow Brokers obtained the files: Either they hacked a server used by NSA hackers to stage attacks that had the files mistakenly left there by an operator, or an agency insider downloaded the data and later leaked it online.” (Source: Business Insider)

The (other) downside to Wikileaks. When Wikileaks first came onto the international stage, the controversial transparency organization received some support for their efforts to add sunlight to the political process. Now many of the site’s original supporters, such as Edward Snowden, are beginning to distance themselves from the site as the organization continues to be plagued by allegations of a lack of proper document vetting, resulting in ordinary people getting hurt. Associated Press reports that the site actually named teenage rape victims, published Social Security numbers of private citizens and even “published the name of a Saudi citizen arrested for being gay, an extraordinary move given that homosexuality is punishable by death in the ultraconservative Muslim kingdom.” (Source: Associated Press)

32 percent of hospitals are not encrypting patient data. @lucasmearian reports that Healthcare Information and Management Systems Society (HIMSS) recently conducted a study that found “about 32 percent of hospitals and 52 percent of non-acute providers—such as outpatient clinics, rehabilitation facilities and physicians’ offices—are not encrypting data in transit, according to a new survey. Additionally, only 61 percent of acute providers and 48 percent of non-acute providers are encrypting data at rest.” In addition to the possibility that this sensitive data could be compromised in a data breach, the study expressed concerns that this “leaves the door wide open to potential tampering and corruption of the data.” (Source: ITWorld)

Canada and Australia find that Ashley Madison violated privacy laws. The controversial dating site with the slogan “Life is short, have an affair,” which suffered a major breach last year has been found to have violated Australian and Canadian privacy laws. Reuters reports, “The probe found the Toronto-based company had inadequate safeguards in place, including poor password management and a fabricated security trustmark on the website’s home page.” The website’s parent company is also currently being investigated by the Federal Trade Commission. (Source: Reuters)

Country not found: Official Ukrainian Twitter accounts hacked. As Ukraine celebrated the 25th anniversary of its independence from Russia, (presumably) Russian hackers sought to steal the joy from the day by hacking Ukraine’s National Guard and Armed Forces social media accounts and posting tweets in Russian declaring “Ukraine is no more” and “Country not found.” (Source: Newsweek)

Agenda for FTC’s Ransomware workshop announced. The FTC will once again convene a who’s who of data security experts for its ransomware workshop on Wednesday, September 7. Because we endeavor to save you precious billable hours, here’s a Twitter list you can follow to stay up-to-date on all the side conversations from the event. See below for more information on the workshop.

Upcoming events

September 7 – Fall Technology Series: Ransomware – Washington, DC
The FTC’s first event in this year’s Fall Technology Series will take place on Wednesday, September 7, 2016 in Washington, DC. This half-day workshop will address how ransomware works, what victims should do, the role of education, and what technological measures can be taken to prevent a ransomware attack.

National Consumers League
Published August 31, 2016

BBUSA Bakeries USA case announcement

August 4, 2016/by

Information about NCL lawsuit alleging BBUSA misrepresentations

August 4, 2016

Contact: NCL’s Cindy Hoang, cindyh@nclnet.org, (202) 835-3323

Washington, DC–On September 26, 2013, the National Consumers League (NCL) filed a lawsuit in the Superior Court of the District of Columbia alleging that Bimbo Bakeries USA (“BBUSA”), through misrepresentations, omissions, and false innuendo, violated six subsections of the District of Columbia Consumer Protection Procedures Act (“DCCPPA”). The NCL alleges that BBUSA misrepresented the whole grain content of its Thomas’ Light Multi-Grain Hearty Muffins and Sara Lee Classic Honey Wheat bread. Specifically, NCL alleges that that consumers are deceived into believing that “Thomas’ Light Multi-Grain Hearty Muffins and Sara Lee Classic Honey Wheat bread contain significant amounts of whole grain, when, in fact, they are predominantly composed of ordinary refined flour (also known as ‘wheat flour’ or ‘enriched wheat flour’) and have minimal, if any, whole grain.” BBUSA responded to these allegations and denied liability. NCL is pleased to report that on April 2, 2015, the Superior Court upheld NCL’s Amended Complaint.

###

About the National Consumers League

The National Consumers League, founded in 1899, is America’s pioneer consumer organization. Our mission is to protect and promote social and economic justice for consumers and workers in the United States and abroad. For more information, visit www.nclnet.org.

The #DataInsecurity Digest | Issue 26

August 1, 2016/by NCL staff

Issue 26 | August 3, 2016

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s Note: We are excited to launch the first of our new series of interviews with thought leaders in the data security policy space, and we could not have hoped for a better inaugural interview than one with FTC Commissioner Terrell McSweeny! Excerpts from our chat are below, and the full interview is available online.

Data security was headline news this week thanks to a leak of 20,000 embarrassing emails taken in a hack of the Democratic National Committee (DNC), allegedly the work of Russian hackers. The disclosure cost DNC Chairwoman Rep. Debbie Wasserman Schultz her job and created a lot of heartburn at a critical moment for the presidential campaign of Hillary Clinton. And more seems set to come, with a new leak of voicemails from the DCCC. All of these breaches have security officials considering whether campaign computer systems should be considered critical infrastructure.

A quick note on scheduling: Like many of you, we’re taking some well deserved R&R in August. We’ll be back with another edition of the #DataInsecurity Digest on August 31.

—————–

Thought Leaders interview with FTC Commissioner Terrell McSweeny

To kick off the #DataInsecurity Thought Leaders series, we were honored to get FTC Commissioner Terrell McSweeny to answer a range of emailed questions about data security policy, including her thoughts on the latest mega-breaches, identity fraud, ransomware encryption, and much more. Excerpts are below and you can read the full interview here.

NCL: What is the state of data security in America? Should consumers be concerned about what companies, the government, and other organizations are doing (or not doing) to safeguard the data that companies hold about them?

Cmmr. McSweeny: The good news is many firms have taken the idea of security by design to heart and have integrated security into the product design process from the start. Many companies do have robust defense in depth security architectures to protect consumer data. On the other hand, there is a wide spectrum of data security practices in the marketplace, and it can be difficult for consumers to know what is going on behind the scenes at the companies that hold their data. I’m particularly concerned about the security of so-called “Internet of Things” products – connected appliances, wearables, cars, televisions etc.

NCL: You’ve become something of a regular at some of the more popular hacker conferences like Black Hat and DEFCON in recent years. What are you hearing at these conferences that has influenced how you’re doing your job at the FTC?

Cmmr. McSweeny: I think it is important to understand as much as possible about how technology works. I always learn a lot from security researchers I meet at these kinds of conferences and from the presentations of research at them. Some of our cases even come to our attention thanks to the work of hackers. I think it is important for the FTC to continue to build relationships with researchers who can be important partners in our work to protect consumer data security and privacy.

NCL: There has been a lot of discussion recently around the issue of encryption, backdoors, and iPhone passcodes. Earlier this year, you wrote about concerns that businesses may be implementing encryption in insecure ways. Has your view about encryption technology evolved given all of the debate around the issue? How does the FTC help consumers take advantage of the security protections that encryption provides?

Cmmr. McSweeny: I personally have highlighted encryption as a vital practice that can allow firms to store and transmit personal information securely. I’m concerned that mandating back doors to break encryption would weaken security protections for consumers and make them worse off. As we connect more things in our daily lives – such as our TVs, watches, appliances, cars – we will increasingly need tools like encryption to make sure that they remain secure. The FTC advises consumers that encryption is key to keeping their information secure, whether it’s transmitted to a website, to a mobile app, or through a wi-fi hotspot.

NCL: Back in 2005, the FTC released a staff report on the threat of spyware, adware, and other unwanted software. In 2008, the Commission testified about the threat of spyware and the principles it relies on in enforcement actions against spyware operators. We recently sent an alert about the related issue of unwanted software (UwS). What are your thoughts on the growing phenomenon of UwS and the threats it may pose to consumers’ online security? Can the FTC do more to protect consumers from UwS?

Cmmr. McSweeny: Unwanted software remains a problem, and we have put out some consumer education on how to avoid it and remove it, including telling consumers to obtain well-known software only directly from manufacturers’ websites, and to be alert when installing new software. This is the type of problem that really needs a broad technological solution, and I know that industry members – such as browser manufacturers – are working diligently to fight the problem, including issuing alerts that will warn consumers about potentially harmful websites. In the same vein, app stores are working hard to police the app marketplaces to reduce the number of malicious apps. Depending upon the specific facts of the case, we could also potentially bring an FTC enforcement action relating to the installation of unwanted software.

Read full interview here.

This edition’s #DataInsecurity Clips

Breach du jour: Cici’s pizza restaurants hacked. News recently came to light that 140 Cici’s restaurants had their point-of-sale systems infected with malware and were thus compromising customer credit and debit cards for months at a time. @EduardKovacs reports, “While in most cases the attackers gained access to PoS systems in March 2016, some restaurants in Florida, Mississippi, North Carolina, Ohio, Tennessee, and Texas had been breached since mid-2015.” @briankrebs was the first to report the breach and has estimated that around 600,000 card numbers were stolen. (Source: Security Week)

DNC hack: Are political campaigns “critical infrastructure?” Although experts generally agree that Russia hacked and stole 20,000 emails from the DNC, experts are not yet sure who subsequently leaked the emails on the eve of the Democratic National Convention, setting off a firestorm of controversy. Regardless of who leaked the emails and their reasoning for doing so, this email dump is highly concerning to current and former national security officials. @nakashimae reports that many senior security officials believe that this breach “could warrant considering whether the elements of the electoral process should be raised to the level of ‘critical infrastructure,’ the same protections that power grids and key financial systems enjoy, so that our elections could be better protected from cyber attacks.” (Source: Washington Post)

Dems getting pWn3d: FBI investigating potential DCCC breach. On the heels of the massive DNC breach, investigators are now looking into a potential breach at the Democratic Congressional Campaign Committee (DCCC) that is believed to be aimed at gathering information about the DCCC’s donors. “Until proven otherwise, I would suggest that everyone involved with the campaign committee operate under the assumption Russians have access to everything in their computer systems,” said Democratic strategist Jim Manley. (Source: Reuters)

Turk Hack Team takes credit for Library of Congress attack. The cyber attack that recently downed the websites of Congress, the Library of Congress, the Congressional Research Service, and the Copyright Office was apparently an act of political protest. Hacktivists “The Turk Hack Team” stated that they launched the attack in response to the United States’ alleged fomenting of the coup that nearly overthrew the Turkish government, writes @thisismaz. “U.S. officials would likely be on the lookout for more hacktivist activity emanating from Turkey. ‘This is the first kind of visible activity generated post-coup, but it doesn’t mean it’s going to be the last,’ said Baron DiCamillo, current partner and CTO of Strategic Cyber Ventures.” (Source: FCW)

Defense department hacked? Department of Defense (DOD) Chief Information Officer Terry Halvorsen recently admitted that the DOD frequently gets hacked. @Politico reports that the DOD receives “a million” cyber attacks a day, and some are successful. Halverson also claimed that we are more secure today than we have been. “We’re attacked more than any other group in the world,” said Halverson. “Do we get hacked? Yes. Percentage of hack against attacks is, like, lower than .001.” (Source: Politico)

POTUS: New cyber threat level helps breach victims know who to call. Last week, President Obama approved a cyber incident directive that, for the first time, puts into writing how the government will assess cyber threats, and who is in charge of helping Americans, businesses, and agencies defuse a cyber threat. In terms of assessing each cyber threat, writes @nakashimae, “The White House has come up with a severity scheme ranging from Level Zero for an inconsequential event to Level 5 for an emergency — or an attack that poses an ‘imminent threat’ to critical systems such as the power grid, federal government stability or people’s lives. … There has been no known incident that would be considered a Level 5, senior officials said. The suspected Russian cyberattack on Ukraine’s electric grid in December that caused widespread power outages probably would have been a Level 4 — a ‘severe’ event that likely would result in ‘significant’ harm to public safety or national security — if it had happened in the United States, the official said.” (Source: Washington Post)

Department of Commerce signals the end of SMS two-factor authentication. The Department of Commerce’s National Institute of Standards and Technology (NIST) has released a draft guide that strongly discourages SMS two-factor authentication, and even hints at a future governmental SMS authentication ban. @thetecheye reports, “NIST officials are discouraging companies from using SMS-based authentication, even saying that SMS-based 2FA might be considered insecure in future versions of the agency’s security guidelines. Basically, SMS-based two-factor authentication is an insecure process because the (consumer) may not always be in possession of the phone.” NIST is suggesting that biometrics may be a better alternative to SMS two-factor authentication. (Source: Techeye)